Insider Attacks Research Articles

Insider threat mitigation: Systematic literature review

The increasing prevalence of cybercrime necessitates the implementation of robust security measures. The majority of these attacks are initiated by authorized users who possess knowledge of the system vulnerabilities. Thus, insider attack prevention (ITP) strategies need to be explored to ensure the security of organizations. This review comprehensively examines the existing literature on ITP methods, focusing on recent developments and their implementation in various corporations. This review categorizes and classifies different types of insider attacks and their corresponding prevention and detection techniques. This paper also introduces a multi-tiered activity monitoring model that integrates network, system, and physical security measures to provide comprehensive defense against insider threats. This review also provides a detailed taxonomy that classifies insider threats based on insider type, access level, and targeted security objectives. Finally, future directions for ITP are explored, highlighting the open issues and challenges that need to be addressed.

The prince of insiders: a multiple pathway approach to understanding IP theft insider attacks

Purpose Intellectual property (IP) theft is an increasing threat that can lead to large financial losses and reputational harm. These attacks are typically noticed only after the IP is stolen, which is usually too late. This paper aims to investigate the psychological profile and the socio-technical events that statistically predict the likelihood of an IP threat. Design/methodology/approach This paper analyses 86 IP theft cases found in court documents. Two novel analyses are conducted. The research uses LLMs to analyse the personality of these insiders, which is followed by an investigation of the pathways to the attack using behaviour sequence analysis (BSA). Findings These IP theft insiders scored significantly higher on measures of Machiavellianism compared to the normal population. Socio-technical variables, including IP theft via photographs, travelling overseas, approaching multiple organisations and delivering presentations, were identified. Contrary to previous assumptions that there is a single pathway to an attack, the authors found that multiple, complex pathways lead to an attack (sometimes multiple attacks). This work, therefore, provides a new framework for considering critical pathways to insider attacks. Practical implications These findings reveal that IP theft insiders may come across as charming, star employees rather than the stereotype of disgruntled employees. Moreover, organisations’ policies may need to consider that IP theft occurs via non-linear and multiple pathways. This means that sequences of events need to be considered in detecting these attacks instead of anomalies outright. The authors also argue that there may be a case for “continuous evaluation” to detect insider activity. Originality/value This paper offers a new framework for understanding and studying insider threats. Instead of a single critical pathway, this work demonstrates the need to consider multiple interconnected pathways. It elucidates the importance of a multidisciplinary approach and provides opportunities to reconsider current practices in detection and prevention.

Mixed fragmentation technique for securing structured data using multi-cloud environment (MFT-SSD)

Large data storage security is a topic of great interest to researchers, particularly in the age of big data where preserving data from theft, unauthorized access, and storage failure has become a crucial concern. To safeguard such data, encryption/decryption approaches have been employed, which are time-consuming and inefficient. The aim of this study is to develop a method, namely Mixed Fragmentation Technique for Securing Structured Data using Multi-Cloud Environment (MFT-SSD), for protecting large-scale data stored in a multi-cloud environment. This prevents insider attacks by adopting a mixed fragmentation approach to split the data into three files. For example, healthcare data is will be distributed among many clouds, each of which stores a partially unrecognized fraction of data without the need for an encryption or decryption layer. Comparing MFT-SSD to various encryption/decryption algorithms, our results show significant improvement; hence, the total performance of big data security is also improved.

Testing a Novel Trauma-Informed Treatment for Anger and Aggression Following Military-Related Betrayal: Design and Methodology of a Clinical Trial.

Difficulty controlling anger is a common postdeployment problem in military personnel. Chronic and unregulated anger can lead to inappropriate aggression and is associated with behavioral health, legal, employment, and relationship problems for military service members. Military-related betrayal (e.g., military sexual assault, insider attacks) is experienced by over a quarter of combat service members and is associated with chronic anger and aggression. The high level of physical risk involved in military deployments make interconnectedness and trust in the military organization of utmost importance for survival during missions. While this has many protective functions, it also creates a vulnerability to experiencing military-related betrayal. Betrayal is related to chronic anger and aggression. Individuals with betrayal-related injuries express overgeneralized anger, irritability, blaming others, expectations of injustice, inability to forgive others, and ruminations of revenge. Current approaches to treating anger and aggression in military populations are inadequate. Standard anger treatment is not trauma-informed and does not consider the unique cultural context of anger and aggression in military populations, therefore is not well suited for anger stemming from military-related betrayal. While trauma-informed interventions targeting anger for military personnel exist, anger outcomes are mixed, and aggression and interpersonal functioning outcomes are poor. Also, these anger interventions are designed for patients with posttraumatic stress disorder. However, not all military-related betrayal meets the Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition-5 definition of trauma, though it may still lead to chronic anger and aggression. As a result, these patients lack access to treatment that appropriately targets the function of their anger and aggression. This manuscript describes rationale, design, and methodology of a pilot clinical trial examining Countering Chronic Anger and Aggression Related to Trauma and Transgressions (CART). CART is a transdiagnostic, transgression-focused intervention for military personnel who have experienced military-related betrayal, targeting chronic anger and aggression, and improving interpersonal relationships. The pilot study will use an interrupted timeseries design, where participants are randomized to a 2-, 3-, or 4-week minimal contact waitlist before starting treatment. This design maximizes the sample size so that all participants receive the treatment and act as their own control, while maintaining a robust design via stepped randomization. This trial aims to (1) test the acceptability and feasibility of CART, (2) test whether CART reduces anger and aggression in military personnel with a history of military-related betrayal, and (3) test whether CART improves interpersonal functioning. The primary feasibility outcome will be the successful recruitment, enrollment, and initiation of 40 participants. Primary outcome measures include the Client Satisfaction Survey-8, the State Trait Anger Expression Inventory-2, Overt Aggression Scale-Modified, and the Inventory of Interpersonal Problems-Short Version. If outcomes show feasibility, acceptability, and initial effectiveness, CART will demonstrate a culturally relevant treatment for chronic anger, the most frequent postdeployment problem, in a sample of active duty service members who have suffered a military betrayal. The DoD will also have an evidence-based treatment option focusing on interpersonal functioning, including relationships within the military and within families.

A provably secure authenticated key agreement protocol for industrial sensor network system

SummaryThe convergence of reliable and self‐organizing characteristics of Wireless Sensor Networks (WSNs) and the IoT has increased the utilization of WSN in different scenarios such as healthcare, industrial units, battlefield monitoring and so forth, yet has also led to significant security risks in their deployment. So, several researchers are developing efficient authentication frameworks with various security and privacy characteristics for WSNs. Subsequently, we review and examine a recently proposed robust key management protocol for an industrial sensor network system. However, their work is incompetent to proffer expedient security and is susceptible to several security attacks. We demonstrate their vulnerabilities against man‐in‐the‐middle attacks, privileged insider attacks, secret key leakage attacks, user, gateway, and sensor node impersonation attacks, and offline password‐guessing attacks. We further highlight the design flaw of no session key agreement in Itoo et al. Therefore to alleviate the existing security issues, we devise an improved key agreement and mutual authentication framework. Our protocol outperforms Itoo et al.'s drawbacks, as demonstrated by the comprehensive security proof performed using the real‐or‐random (ROR) model and the formal verification accomplished using the Automated Validation of Internet Security Protocols (AVISPA) tool.

Matryoshka: Exploiting the Over-Parametrization of Deep Learning Models for Covert Data Transmission.

High-quality private machine learning (ML) data stored in local data centers becomes a key competitive factor for AI corporations. In this paper, we present a novel insider attack called Matryoshka to reveal the possibility of breaking the privacy of ML data even with no exposed interface. Our attack employs a scheduled-to-publish DNN model as a carrier model for covert transmission of secret models which memorize the information of private ML data that otherwise has no interface to the outsider. At the core of our attack, we present a novel parameter sharing approach which exploits the learning capacity of the carrier model for information hiding. Our approach simultaneously achieves: (i) High Capacity - With almost no utility loss of the carrier model, Matryoshka can transmit over 10,000 real-world data samples within a carrier model which has 220× less parameters than the total size of the stolen data, and simultaneously transmit multiple heterogeneous datasets or models within a single carrier model under a trivial distortion rate, neither of which can be done with existing steganography techniques; (ii) Decoding Efficiency - once downloading the published carrier model, an outside colluder can exclusively decode the hidden models from the carrier model with only several integer secrets and the knowledge of the hidden model architecture; (iii) Effectiveness - Moreover, almost all the recovered models either have similar performance as if it is trained independently on the private data, or can be further used to extract memorized raw training data with low error; (iv) Robustness - Information redundancy is naturally implemented to achieve resilience against common post-processing techniques on the carrier before its publishing; (v) Covertness - A model inspector with different levels of prior knowledge could hardly differentiate a carrier model from a normal model.

Strengthening Fintech Security in Uganda: An Analysis of Insider Threats and Effective Risk Management Strategies

Purpose: The purpose of this study is to analyze security policies and risk management practices for reducing insider threats in the Fintech industry in Uganda. The study aims to classify and identify insider threats, examine how they relate to risk management procedures, and offer practical recommendations for improving Fintech companies’ security measures. Methodology: The study adopted a descriptive research design, focusing on diverse respondents across various sectors. Data was collected through surveys from 25 respondents, including IT security specialists, accountants, finance officers, and other relevant roles. The sectors represented included Banking and Finance (52%), Security (12%), Information Technology and Telecommunications (8% each), and others such as Agriculture, Civil Society, and Public Service (each 4%). The study employed both qualitative and quantitative data collection methods, with secondary data reviewed from existing literature and case studies. Statistical analysis was conducted using SPSS to interpret the data and identify trends in insider threat occurrences and risk management practices. Findings: The study revealed that insider threats in Uganda's Fintech sector can manifest in both physical and cyber forms. The predominant risk management practices identified include proactive measures such as robust security policies, access controls utilized by 88% of respondents, security awareness training by 80%, and continuous monitoring by 68%. Incident response and reporting procedures were also critical, ensuring that breaches are swiftly addressed to minimize impact. There was a significant positive correlation (r = .65; p < 0.05) between the frequency of past insider attacks and the regularity of risk assessments, underscoring the importance of regular evaluations in mitigating risks. Unique Contribution to Theory, Practice and Policy: The study contributes to the theoretical understanding of how local cultural attitudes and regulatory frameworks impact effectiveness of risk management strategies, providing insights that can inform RMF adaptations in similar contexts. For practitioners, it recommends development and implementation of robust security policies, employee training programs, and advanced monitoring systems. Policy-makers are advised to support regulatory frameworks that mandate regular risk assessments and the adoption of best Fintech practices.

Cybersecurity in supply chains: Addressing emerging threats with strategic measures

This review paper explores the evolving landscape of cybersecurity threats within supply chains, highlighting strategic measures necessary to mitigate these risks. As supply chains integrate more deeply with digital technologies and global networks, they become more vulnerable to sophisticated cyber attacks that can severely disrupt operational integrity and security. This paper synthesizes existing literature to outline the major cybersecurity challenges faced by supply chains, examining case studies and best practices from various industries. Our findings underscore the prevalent threats such as ransomware, phishing, and insider attacks, which exploit the complex interdependencies and digital interfaces in supply chains. The review identifies effective strategic responses, including the integration of comprehensive cybersecurity frameworks, enhanced inter-organizational cooperation, and the implementation of real-time threat detection systems. Conclusively, the paper advocates for a holistic and proactive approach to cybersecurity, emphasizing continuous improvement and adaptive strategies to protect against the dynamic nature of cyber threats in supply chain contexts. Keywords: Cybersecurity, Supply Chain Management, Risk Assessment, Continuous Monitoring, Incident Response, Blockchain Technology, Artificial Intelligence (AI), Collaboration and Information Sharing, Cyber Threats, Emerging Technologies.

An edge-assisted group authentication scheme for the narrowband internet of things

As an emerging wireless communication technology, narrowband Internet of Things is widely used in various scenarios, but it also brings new security problems, especially the group authentication between terminal devices and servers. In narrowband Internet of Things, terminal devices are often deployed in unattended environments, which are vulnerable to various attacks and controlled by adversaries, resulting in identity information leakage. Secondly, a large number of terminal devices send authentication request information to the server at the same time, which is easy to cause network signaling congestion, and the centralized calculation mode of the server will cause a large delay in the authentication process. To solve these problems, we propose an edge-assisted group authentication scheme for narrowband Internet of Things. Firstly, a lightweight encryption algorithm LCHAOSAES was used to encrypt the terminal device identity to prevent the terminal device identity information leakage. Then, the edge computing method was used to add an edge network layer to the NB-IoT system architecture to assist in completing the group authentication of massive terminal devices, and the edge assistance could realize decentralization and reduce the load of centralized processing of the server. The Burrows Abadi Needham logic verification, informal security analysis and performance analysis show that the proposed scheme is robust under malicious attacks such as replay attack, man-in-the-middle attack and insider attack, and has less signaling overhead and delay.

MCAD: A Machine Learning Based Cyber Attack Detector using SDN for Healthcare Systems

The healthcare industry, increasingly reliant on digital technology, has become a prime target for cyberattacks. While traditional security measures address external threats, they often fail to effectively counter a particularly dangerous foe: insider threats. This project proposes MCAD (Machine Learning-based CyberAttack Detector), a groundbreaking approach that leverages the power of machine learning within Software-Defined Networks (SDNs) to bolster healthcare network security. Healthcare networks are inherently complex ecosystems, housing a diverse range of medical devices alongside traditional IT infrastructure. This intricate web creates a larger attack surface for malicious insiders with access to critical systems. These insiders can be disgruntled employees or attackers exploiting vulnerabilities in poorly designed systems. The COVID-19 pandemic further exacerbated this vulnerability as the surge in telehealth services and remote access points opened new avenues for exploitation. The statistics are alarming, with a staggering 92% of healthcare organizations reporting insider-caused security breaches. These breaches not only compromise sensitive patient data but can also disrupt critical healthcare services, potentially jeopardizing patient safety. MCAD, a Machine Learning-based Cyber Attack Detector, tackles the growing threat of insider attacks in healthcare networks. It employs a multi-pronged approach: collecting both normal and abnormal network traffic to train a real-time machine learning model. This model continuously analyzes network activity, identifying suspicious behavior indicative of insider threats. MCAD seamlessly integrates with SDN controllers for efficient deployment within existing infrastructure, and undergoes rigorous testing with various machine learning algorithms and simulated attacks to ensure optimal protection against evolving cyber threats.

Insider Attack Prevention: LAPUP—Lightweight Authentication Protocol Using PUF

Insider Attack Prevention: LAPUP—Lightweight Authentication Protocol Using PUF

Li-MSD: A lightweight mitigation solution for DAO insider attack in RPL-based IoT

Many IoT applications run on a wireless infrastructure supported by resource-constrained nodes which is popularly known as Low-Power and Lossy Networks (LLNs). Currently, LLNs play a vital role in digital transformation of industries. The resource limitations of LLNs restrict the usage of traditional routing protocols and therefore require an energy-efficient routing solution. IETF’s Routing Protocol for Low-power Lossy Networks (RPL, pronounced “ripple”) is one of the most popular energy-efficient protocols for LLNs, specified in RFC 6550. In RPL, Destination Advertisement Object (DAO) control message is transmitted by a child node to pass on its reachability information to its immediate parent or root node. An attacker may exploit the insecure DAO sending mechanism of RPL to perform “DAO insider attack” by transmitting DAO multiple times. This paper shows that an aggressive DAO insider attacker can drastically degrade network performance. We propose a Lightweight Mitigation Solution for DAO insider attack, which is termed as “Li-MSD”. Li-MSD uses a blacklisting strategy to mitigate the attack and restore RPL performance, significantly. By using simulations, it is shown that Li-MSD outperforms the existing solution in the literature.

SEAF-IoD: Secure and efficient user authentication framework for the Internet of Drones

The Internet of Drones (IoD) stands as a rapidly advancing technology, finding applications across civilian, military, and industrial domains, facilitating the efficient execution of challenging tasks. However, the IoD environment introduces a plethora of security concerns. Drones, for example, must exchange critical information with control station servers and users through open and unsecured wireless channels. Consequently, protecting these sensitive data becomes paramount, leading to the development of SEAF-IoD, a secure and efficient user authentication framework for the IoD, as presented in this paper. SEAF-IoD relies on symmetric encryption, physical uncloneable functions (PUF), and hash functions. This framework empowers users to securely establish connections and obtain real-time data from specific drones deployed within the IoD environment. Furthermore, the utilization of PUF holds great promise in achieving cost-effective security. PUF obviates the necessity to store confidential keys in device memory, offering a potential alternative for establishing a more secure and cost-efficient authentication framework for IoD systems. PUF empowers the SEAF-IoD to enhance its resilience against privileged insider attacks and drone/device capture attempts. To ensure the robustness of SEAF-IoD, it undergoes rigorous validation using BAN logic and Scyther simulation. Furthermore, an informal analysis affirms that SEAF-IoD fulfills critical security requirements and effectively thwarts various adversarial threats, including privileged insider, replay, and impersonation attacks. A comprehensive comparison of SEAF-IoD against existing schemes highlights its resilience and superiority in safeguarding IoD environments.

Improved restricted Boltzmann machine-based optimization model for the network security system in cloud environment

This paper introduces a novel approach to enhancing computer network security through deep learning and cloud technologies, focusing on combating insider DDoS attacks in cloud computing. By employing the IRBM architecture and a trust-oriented secure cloud framework, the work utilizes parameter tuning in RBM through the Gradient-Based Optimization (GBO) algorithm resulting in the proposed IRBM-GBO model. This model significantly outperforms SVM, SC-CNSP-ML, and RBM in terms of latency and Packet Delivery Ratio (PDR), showing 21.67%, 14.55%, and 9.62% improvements in latency, and 10.23%, 5.43%, and 12.79% in PDR, respectively. The research highlights the potential of combining soft computing with deep learning and cloud technologies to identify cyberattacks by emphasising improvements in latency, Quality of Service (QoS), throughput, and PDR across various cybersecurity datasets.

BWM Integrated VIKOR method using Neutrosophic fuzzy sets for cybersecurity risk assessment of connected and autonomous vehicles

Connected and autonomous vehicles (CAVs) have gained significant importance in intelligent transportation systems. However, CAVs are associated with significant cyber-risks caused by different threat-agents, which require robust mitigation strategies for secure operation. Different categories of threat-agents come with varying resources, motivation, and skills that must be addressed effectively for the secure operation of CAVs. This study offers a comprehensive analysis of cybersecurity risks from different categories of threat-agents targeting CAVs. A novel hybrid multi-criteria decision making (MCDM) technique has been developed to prioritize the threat-agent categories as part of the cyber defense mechanism. In this study, the major threat-agent categories are identified from the existing literature and cybersecurity reports. Then expert opinion is collected on the likelihood and severity of cyber-attacks undertaken by different threat-agent categories. Single-valued neutrosophic fuzzy sets (SVNFS) are implemented to consolidate the subjectivity of the linguistic opinions given by the experts. Then Best-Worst Method (BWM) is used to determine the relative criteria weightage on the cyber-attack consequences. These weights are then supplied to the ViseKriterijum-ska Optimizacija I Kompromisno Resenj (VIKOR) method for ranking the categories of threat-agents based on the risk perceived by the experts. A case study is presented with five categories of threat-agents and five loss criteria targeting CAVs to validate the viability of the proposed model. The result shows that insider attackers pose maximum risk for cybersecurity of CAVs. The proposed technique will provide helpful insights to the decision-makers for formulating effective defense strategies against cyber-attackers.

THE ROLE OF BIG DATA IN SYSTEMS ENGINEERING: A REVIEW

This research review explores the transformative intersection of Big Data and Systems Engineering (SE), a convergence that leverages the vast capabilities of Big Data analytics to enhance the design, analysis, and management of complex systems. As the digital era ushers in unprecedented volumes of data, traditional systems engineering approaches are challenged to adapt, necessitating a paradigm shift towards integrating Big Data technologies. This review draws on recent scholarly contributions to highlight the implications, challenges, and innovative solutions emerging at this intersection. The integration of Big Data into Systems Engineering introduces significant opportunities for innovation. By processing and analyzing vast datasets, systems engineers can uncover hidden patterns and insights, leading to more efficient, reliable, and adaptable systems. However, this integration is not without its challenges. Information security emerges as a paramount concern, with the risk of insider attacks necessitating the development of new architectural solutions. Furthermore, the benchmarking and evaluation of Big Data systems present unique challenges due to the diversity of data and workloads involved. To address these challenges, this review examines several key contributions to the field. It discusses a formal framework for designing information systems that handle heterogeneous data, emphasizing the role of ontological models in separating system architecture from its implementation. The review also highlights the importance of security in Big Data systems, proposing a novel architecture for detecting insider attacks through data replication. Additionally, it explores the development of BigDataBench, a benchmark suite that facilitates the comprehensive evaluation of Big Data systems and architectures. Moreover, the review delves into the design of Big Data analytics architectures, focusing on goal-oriented modeling and the resolution of obstacles to quality goal achievement. It also introduces datar, a unified framework for Big Data Management Systems, showcasing a solution that manages Big Data in a pluggable, automatic, and intelligent manner. In conclusion, the intersection of Big Data and Systems Engineering heralds a new era of system design and management. By addressing the inherent challenges and leveraging innovative solutions, this convergence holds the potential to significantly enhance the capabilities of Systems Engineering, driving forward the development of complex, data-driven systems.
 Keywords: Big Data, Systems Engineering, Information Security, Data Management Systems, Benchmarking Big Data Systems.

Data Privacy Preservation and Authentication Scheme for Secured IoMT Communication Using Enhanced Heuristic Approach with Deep Learning

Internet of Medical Things (IoMT) is a promising field that is widely used in healthcare applications nowadays. The IoMT is an extension of the Internet of Things (IoT) that is utilized for the processing, generation, collection, and evaluation of medical data. However, the most concerning issue in IoMT is regarding the privacy and protection of the IoMT data. Because privacy preservation of information is the major concern in IoT-based healthcare systems. Hence, there is a need for a trustworthy end-to-end system, which can tolerate even insider attacks. The core aim of this research work is to promote the latest secure technique for transmitting the data from sink nodes to the server and also to ensure the security level of communication between them. Here, the gathered sink node is authenticated by deep hybrid methods of combining the Auto Encoder (AE) and Bidirectional Long Short-Term Memory (BiLSTM). This hybrid model is named as Auto Encoder-Bidirectional Long Short-Term Memory (AE-Bi-LSTM), in which the parameters are tuned by the Improved Chimp Optimization Algorithm (IChoA). Hence, data privacy preservation makes to secure communication in the networks. The proposed privacy-prevention model is utilized for maintaining communication between sink nodes and servers. The communication is done through three different steps (a) Sanitation, (b) Optimal key generation, and (c) Restoration. Moreover, from the overall result analysis, the accuracy and precision rate of the designed IChoA-AE-Bi-LSTM approach are 95.58 and 91.93%. The experimental analysis shows that the designed model offers a better authentication scheme and guarantees data privacy than traditional models. Moreover, applying a high amount of energy will reduce the lifetime of the sensor nodes. Here, privacy preservation is a challenging task due to fraudulent attacks from third-party service providers. In the future, advanced techniques will be implemented with lightweight encoded mechanisms.

A Survey of Security Challenges in Cloud-Based SCADA Systems

Supervisory control and data acquisition (SCADA) systems enable industrial organizations to control and monitor real-time data and industrial processes. Migrating SCADA systems to cloud environments can enhance the performance of traditional systems by improving storage capacity, reliability, and availability while reducing technical and industrial costs. However, the increasing frequency of cloud cyberattacks poses a significant challenge to such systems. In addition, current research on cloud-based SCADA systems often focuses on a limited range of attack types, with findings scattered across various studies. This research comprehensively surveys the most common cybersecurity vulnerabilities and attacks facing cloud-based SCADA systems. It identifies four primary vulnerability factors: connectivity with cloud services, shared infrastructure, malicious insiders, and the security of SCADA protocols. This study categorizes cyberattacks targeting these systems into five main groups: hardware, software, communication and protocol-specific, control process, and insider attacks. In addition, this study proposes security solutions to mitigate the impact of cyberattacks on these control systems.

Blockchain based general data protection regulation compliant data breach detection system

Context Data breaches caused by insiders are on the rise, both in terms of frequency and financial impact on organizations. Insider threat originates from within the targeted organization and users with authorized access to an organization’s network, applications, or databases commit insider attacks. Motivation Insider attacks are difficult to detect because an attacker with administrator capabilities can change logs and login records to destroy the evidence of the attack. Moreover, when such a harmful insider attack goes undetected for months, it can do a lot of damage. Such data breaches may significantly impact the affected data owner’s life. Developing a system for rapidly detecting data breaches is still critical and challenging. General Data Protection Regulation (GDPR) has defined the procedures and policies to mitigate the problems of data protection. Therefore, under the GDPR implementation, the data controller must notify the data protection authority when a data breach has occurred. Problem Statement Existing data breach detection mechanisms rely on a reliable third party. Because of the presence of a third party, such systems are not trustworthy, transparent, secure, immutable, and GDPR-compliant. Contributions To overcome these issues, this study proposed a GDPR-compliant data breach detection system by leveraging the benefits of blockchain technology. Smart contracts are written in Solidity and deployed on a local Ethereum test network to implement the solution. The proposed system can generate alert notifications against every data breach. Results We tested and deployed our proposed system, and the findings indicate that it can accomplish the insider threat mitigation objective. Furthermore, the GDPR compliance analysis of our system was also evaluated to make sure that it complies with the GDPR principles (such as right to be forgotten, access control, conditions for consent, and breach notifications). The conducted analysis has confirmed that the proposed system offers capabilities to comply with the GDPR from an application standpoint.

Organizations' readiness for insider attacks: A process‐oriented approach

AbstractContextOrganizations constantly strive to protect their assets from outsider attacks by implementing various security controls, such as data encryption algorithms, intrusion detection software, firewalls, and antivirus programs. Unfortunately, attackers strike not only from outside the organization but also from within. Such internal attacks are called insider attacks or threats, and the people responsible for them are insider attackers or insider threat agents. Insider attacks pose more significant risks and can result in greater organizational losses than outsider attacks. Thus, every organization should be vigilant regarding such attackers to protect its valuable resources from harm. Finding solutions to protect organizations from such attacks is critical. Despite the importance of this topic, little research has been conducted on providing solutions to mitigate insider attacks.ObjectiveThis study aims to develop an organizational readiness model to assess an organization's readiness for insider attacks.MethodWe conducted a multivocal literature review to identify practices that can be used to assess organizations' readiness against insider attacks. These practices were grouped into different knowledge areas of insider attacks for organizations. The insider attack readiness model was developed using identified best practices and knowledge areas: compliance, top management, human resources, and technical.ResultsThis model was evaluated at two levels—academic and real‐world environments. The evaluation results show that the proposed model can identify organizations' readiness against insider attacks.ConclusionThe proposed model can guide organizations through a secure environment against insider attacks.